Who contributed to Vercel on May 5, 2026?

10 developers shipped this update, including vincent-derks, gscho, ricardo-agz, Strernd, github-actions[bot], lukesandberg, mischnic, and felixarntz, and 2 more.

What were the notable Vercel updates?

fix(cli): tighten SdkKey type to keep plaintext off list responses, [python] More granular errors for entrypoint failures, and [services] fix nitro index.html fallback route bug.

@vercel

Next.js + the Vercel platform - frontend infrastructure for the web

github ↗

Pick a date

Topics: JavaScript Full archive →

The Wire · Showcase

SDK KEYS LOCKED DOWN, PYTHON ERRORS SHARPER, NITRO ROUTES FIXED

By RepoJournal · Filed 06:00 UTC on May 5, 2026 · About Vercel

10 people shipped this

vincent-derks @vincent-derks 1 cited

gscho @gscho 1 cited

ricardo-agz @ricardo-agz 1 cited

Strernd @Strernd 1 cited

github-actions[bot] @github-actions[bot] 1 cited

lukesandberg @lukesandberg 1 cited

mischnic @mischnic 1 cited

felixarntz @felixarntz 1 cited

zirkelc @zirkelc 1 cited

Christian-Sidak @Christian-Sidak 1 cited

Vercel tightened SDK key security at the type layer while Python builders now surface granular entrypoint errors that actually tell you what went wrong.

The CLI can no longer accidentally leak plaintext SDK secrets in list responses [1] — the type system now enforces a split between creation (where you see the secret once) and listing (where you never do). Meanwhile, Python function deployments got the debugging upgrade they needed: entrypoint failures now surface specific, actionable errors instead of generic failures [2], giving your team actual clues about what broke. On the framework side, Nitro services in experimentalServices were generating phantom index.html routes that shadowed the real builder output [3], now fixed. React Router single-fetch routing in Remix got its .data function entries restored [4], keeping route splitting intact. The Python build system now caches dependencies by default [5], cutting rebuild times. Across Next.js, the turbo-tasks backend squashed snapshot coordination races that could corrupt concurrent operations [6], and cache handlers now include deployment IDs to avoid collisions across environments [7]. Vercel/AI locked down timeout abort reasons with proper TimeoutError semantics [9], and Mistral's cached token counts now map correctly instead of lumping everything into noCacheTokens [10]. Workflow serialization now preserves full error objects through the pipeline [11], and request timeouts on workflow-server calls prevent idle hangs during replays [12]. Cohere image support landed [8], letting vision models actually receive images instead of treating them as RAG documents.

Action items

→ Deploy vercel@latest to lock down SDK key type safety before next cli release vercel/vercel [immediate]
→ Update Python builder to 6.38.0 and surface entrypoint errors in your observability vercel/vercel [plan]
→ Test Nitro experimentalServices builds — index.html shadowing is gone vercel/vercel [monitor]
→ Upgrade to turbo-tasks backend fix if you're hitting snapshot coordination issues vercel/next.js [plan]

References

[1] fix(cli): tighten SdkKey type to keep plaintext off list responses ↗ vercel/vercel
[2] [python] More granular errors for entrypoint failures. ↗ vercel/vercel
[3] [services] fix nitro index.html fallback route bug ↗ vercel/vercel
[4] [codex] Preserve React Router single-fetch .data route config ↗ vercel/vercel
[5] Version Packages ↗ vercel/vercel
[6] turbo-tasks-backend: fix snapshot coordination races + extract SnapshotCoordinator ↗ vercel/next.js
[7] Include deployment id in `cacheHandlers` keys ↗ vercel/next.js
[8] feat(provider/cohere): add support for passing images to Cohere models ↗ vercel/ai
[9] fix(ai): tag step/chunk timeout aborts with TimeoutError reason ↗ vercel/ai
[10] fix(mistral): map cached token counts from Mistral usage response ↗ vercel/ai
[11] Serialize `run_failed`/`step_failed` errors through serialization pipeline (#1851) vercel/workflow
[12] fix(world-vercel): add default request timeout to workflow-server HTTP calls (#1807) vercel/workflow

Quick answers

What shipped in Vercel on May 5, 2026?: Vercel tightened SDK key security at the type layer while Python builders now surface granular entrypoint errors that actually tell you what went wrong. In total, 44 commits, 51 pull requests, and 17 releases landed.
Who contributed to Vercel on May 5, 2026?: 10 developers shipped this update, including vincent-derks, gscho, ricardo-agz, Strernd, github-actions[bot], lukesandberg, mischnic, and felixarntz, and 2 more.
What were the notable Vercel updates?: fix(cli): tighten SdkKey type to keep plaintext off list responses, [python] More granular errors for entrypoint failures, and [services] fix nitro index.html fallback route bug.

NEXT.JS OPTIMIZES APP ROUTING ENTRY POINTS WHILE WORKFLOW CUTS STREAM LATENCY 20 PERCENT

Next.js extracted invariant app-page handlers into shared runtime modules while Workflow's stream write batching moves into core, eliminating per-token round trips on idle producers.

+11

javascript 126 shipped 2-min read

@vercel 1 day ago

TWO CRITICAL SECURITY PATCHES LAND IN WORKFLOW AND EVE OVERNIGHT

Next 16.2.11 and PostCSS 8.5.12 patches ship across workflow to seal CVE vulnerabilities, while Eve locks down workflow failure visibility.

javascript 153 shipped 1-min read

@vercel 2 days ago

WORKFLOW 5.0 BETA ARRIVES WITH HOOK TOKEN RETENTION, AI SDK FIXES GEMINI AND BEDROCK HALLUCINATIONS

Workflow shipped its most ambitious beta yet with experimental token retention, while the AI SDK shipped five critical fixes across Gemini, Bedrock, and dynamic tool validation in a single push.

javascript 132 shipped 2-min read

@vercel 3 days ago

NEXT.JS PATCHES FIVE SECURITY HOLES OVERNIGHT WHILE VERCEL CLI GAINS AI GATEWAY BUDGET CONTROLS

Five security advisories dropped across Next.js in the last 24 hours, ranging from origin validation on internal redirects to fetch cache key collisions that could leak cached responses between requests.

+12

javascript 145 shipped 2-min read

Elsewhere on the wire

AI Agents about 9 hours ago

CLAUDE OPUS 5 LANDS ACROSS THE STACK

The newest Anthropic model is now live in langchain, Cline, and llama-index, with native support for extended reasoning and 1M context windows.

ai-agents 28 shipped 1-min read

Local LLMs about 9 hours ago

OLLAMA LANDS LAGUNA SUPPORT AND CRUSHES MEMORY LEAKS WHILE SGLANG HITS V0.5.16 WITH CONFIDENCE-DRIVEN SPECULATIVE DECODING

Ollama shipped three critical performance and reliability fixes for Metal residency and concurrent access patterns, while SGL-Lang released 0.5.16 with a new speculative algorithm hitting 383.7 tok/s on DeepSeek-V4.